James Lam on ERM, Strategy, and the Modern CRO

RIMScast

00:00

Evolving Role of the Chief Risk Officer

This chapter explores the transformation of the Chief Risk Officer's role over the past five years, particularly in light of the pandemic and increasing geopolitical risks. It highlights the essential competencies that distinguish successful CROs from their peers, emphasizing a shift from compliance to strategic decision-making. Using E-Trade as a case study, the chapter illustrates how a refined risk appetite framework can drive business innovation and sustainable profitability.

Transcript

chevron_right

Play full episode

chevron_right

Transcript

Episode notes

Welcome to RIMScast. Your host is Justin Smulison, Business Content Manager at RIMS, the Risk and Insurance Management Society.

Justin interviews James Lam about the evolving role of the CRO since the pandemic, vital competencies for today’s CROs, risk appetite frameworks, and a case study of E*Trade and how they succeeded with a strong risk appetite framework. They continue the discussion with an examination of James’s upcoming six-module virtual course, the RIMS-CRO Certificate in Advanced Enterprise Risk Management. James concludes with his vision of the future of ERM using AI as an enabling tool.

Listen to learn more about successful strategies CROs can apply to their ERM programs.

Key Takeaways:

[:01] About RIMS and RIMScast.

[:17] About this episode of RIMScast. Our guest is one of the great thought leaders in risk management, James Lam. He returns to RIMScast today to talk about ERM and a new bi-weekly virtual course he’ll be teaching for RIMS that begins in July.

[:48] RIMS-CRMP Workshops! Register by July 1st for the next RIMS-CRMP Virtual Workshop, which will be co-led by Parima. That course will be held on July 8th and 9th.

[1:04] The next RIMS-CRMP-FED virtual workshop will be led by Joseph Mayo on July 17th and 18th. Register by July 16th. Links to these courses can be found on the Certification Page of RIMS.org and through this episode’s show notes.

[1:23] RIMS Webinars! The next RIMS Webinar will be held on June 17th. It will be presented by Origami Risk. It’s titled “Strategic Risk Financing in an Unstable Economy: Leveraging Technology for Efficiency and Cost Reduction”. Register today through RIMS.org/Webinars

[1:43] RIMS Virtual Workshops! On June 12th, Pat Saporito will host “Managing Data for ERM”, and she will return on June 26th to present the very popular new course, “Generative AI for Risk Management”.

[2:00] A link to the full schedule of virtual workshops can be found on the RIMS.org/education and RIMS.org/education/online-learning pages. A link is also in this episode’s show notes.

[2:12] Mark your calendars for November 17th and 18th for the RIMS ERM Conference 2025 in Seattle, Washington. The agenda is being built. Soon, we will distribute a Call for Nominations for the ERM Award of Distinction. I’ll update this episode’s show notes when that link is ready.

[2:35] Think about your organization’s ERM program or one that you know of, and how it has generated value. We will have more on that in the coming weeks.

[2:43] On with the show! Our guest today is a risk management trailblazer who is widely considered the world’s first Chief Risk Officer. I’m talking about James Lam.

[2:54] Starting on July 16th, James will host a six-module course for RIMS, The RIMS-CRO Certificate in Advanced Enterprise Risk Management. It’s a bi-weekly course that will run through Wednesday, September 24th. Registration closes on July 9th.

[3:14] James is here to discuss and share his ERM philosophies, how the practice has changed in the past five years since he was last on the show, and to give us a preview of what the upcoming course will be like and how it could boost your risk career.

[3:31] Interview! James Lam, welcome back to RIMScast!

[3:37] James was a guest on RIMScast in the Fall of 2020. We’ve gone through a lot in the last five years! We’ve lived through a pandemic, and companies realized the importance of operational resilience and strategic risk management.

[4:14] James says today we are facing unprecedented geopolitical risk. We are also facing AI risks and opportunities. Some Chief Risk Officers have stayed relevant and elevated their careers and skills, while others have failed in their organization’s ERM programs.

[5:01] James tells what may cause a CRO to fail. Applying a “check the box” approach or a compliance approach, without staying relevant with the evolving risk landscape.

[5:29] Speaking of successful CROs, James said one CRO he worked with went from being a treasurer reporting to the CFO, to becoming the CRO, then the CFO, and eventually the CEO, all within eight years.

[5:58] He and other successful CROs had learned how to add strategic value and be relevant to key decision-makers at the board level and the executive level.

[6:15] A key competence is applying risk analytics to quantify and minimize unexpected earnings, helping companies maintain sustainable, predictable profitability.

[6:40] Then, evolving that to understanding capital management to optimize capital allocation, dividend policies, and risk transfer strategies, ultimately, applying the same risk analytics to support corporate and business decisions.

[7:05] Being able to add strategic value is the most important competence for a Chief Risk Officer today.

[7:26] Management and corporate directors are concerned about the unexpected. As CROs, how do we connect our work with things that are the most meaningful to the decision-makers and key internal stakeholders? All boards, CEOs, and CFOs are concerned about earnings.

[7:53] Unexpected earnings variance and guidance are things that they are concerned about. CROs can help them with predictable profitability, long-term capital management, and value creation.

[8:10] How does a CRO support the leaders’ decision-making at the corporate level, where there’s M&A or new products, and at the business level, in terms of risk-based pricing and risk transfer decisions?

[8:43] James thinks the risk appetite framework is one of the most important processes and capabilities for advanced enterprise risk management.

[9:01] Frameworks that don’t do well tend to be mostly or entirely qualitative. They tend to be static, maybe updated once a year, with very little change.

[9:15] The frameworks that are more strategic and add more value to companies tend to be a combination of quantitative and qualitative.

[9:42] Successful risk appetite frameworks also consider risk capacity in terms of capital resources, earnings, and liquidity, relative to our risk management capability and track record.

[10:01] Successful risk appetite frameworks look at opportunities. What is the opportunity for profitability, growth, and innovation, relative to risk? If the opportunity is high, then we should be willing to take on more risk.

[10:19] Successful risk appetite frameworks tend to be more dynamic in a way that allows the company to reduce risk when it is appropriate but also to take more risk when it is appropriate.

[10:31] James says a good risk appetite framework would guide organizations to take more risk, on a selective basis.

[10:57] James uses E*Trade as a case study. James was on the board of E*Trade and chaired its risk committee. This case study is in the RIMS CRO Certificate Program in Advanced Enterprise Risk Management.

[11:28] James will invite E*Trade’s CRO, the head of ERM, and one of the regulators, to provide first-hand experiences and lessons learned.

[11:41] James gives examples of how ERM improved E*Trade’s business outcomes and profitability. Based on a robust risk appetite framework, E*Trade thought it needed to take more risk in new product innovation and shorten the time to market dramatically.

[12:21] Because of that, E*Trade was the first company to offer retail investors the capability to trade stocks and mutual funds on their Apple Watch. It was a very important business opportunity as the Apple Watch was hugely popular.

[12:49] This tied into E*Trade’s founding as the first internet company to allow retail investors to trade on the internet. It was a proud moment for E*Trade. It shows how a robust ERM program and risk appetite framework can support innovation and business growth.

[13:16] In the eight years James was on E*Trade’s board until it was sold, its stock went from $8 to $59 a share. It went from B to BBB, from losing money to making money, and from a weak capital position to buying back over $1 billion in stock and offering its first-ever dividend.

[13:52] In addition to the E*Trade case study, the course will look into other case studies, good and bad. We will learn from organizations that didn’t manage risks effectively and what we could learn from them to prevent that for our organizations.

[14:13] We will learn from best-practice companies in the energy and healthcare space.

[14:30] Plug Time! The very first RIMS Texas Regional Conference will be held from August 4th through the 6th in San Antonio at the Henry B. González Convention Center. Public Registration is open here.

[14:43] Hotel cut-off for the discounted rate is available through July 7th. The full Conference Agenda is now live, so you can start planning your experience. Don’t miss the post-conference workshop, the RIMS-CRMP Exam Prep Course, available onsite.

[14:59] Any chapter member can attend. Links are in this episode’s show notes.

[15:14] You can also visit the Events Page of RIMS.org for more information. We look forward to seeing you in Texas!

[15:21 Just a month later, we will be up North for the RIMS Canada Conference 2025, from September 14th through 17th in Calgary. Registration opened today. Visit RIMSCanadaConference.CA and lock in favorable rates. We look forward to seeing you there!

[15:42] Let’s Return to My Interview with James Lam!

[16:00] Starting on July 16th, there will be a new course that James is leading. It’s the RIMS CRO Certificate Program in Advanced Enterprise Risk Management. If you’re listening to this on the week of publication, you’ve got about a month to register. Registration closes on July 9th.

[16:22] James is one of our favorite collaborators!

[16:27] James tells what led to the launch of this program. He’s very excited to be partnering with RIMS! His motivation for doing this program is that he has worked in risk management for over 40 years. He has been a management consultant working with over 100 companies.

[17:10] James has been an eight-time board member, chairing the risk committee, chairing the audit committee, and overseeing risk management, not day-to-day but from a board perspective.

[17:22] What James wants to do in this program is to share the lessons he has learned and some of the best practices in a very practical way. He also wants to invite other risk experts to share from their different domains. James has had this idea for over three years.

[17:56] He met with the RIMS board members and the Professional Development Team to talk about this. They got an agreement in place, and within a few weeks, they got the outline and the website up. James tells of the team that helped him put it together in bi-weekly meetings.

[18:31] The program came together within weeks. The early registrations are above expectations. The market reception has been strong. James says this course will provide an amazing learning experience for the participants.

[18:54] It’s a six-module, bi-weekly course with four-hour live virtual sessions, from 10 a.m. to 2 p.m. Eastern Time, starting July 16th and running through September 24th. There will also be self-study with James’s book, other articles, and research papers.

[19:24] We’ve got the link in this episode’s show notes. A brief description of each of the six modules is on the website. Module 4 is The Role of the Chief Risk Officer and Risk Appetite Statement. That’s the James Lam wheelhouse!

[19:44] The CRO, the risk appetite statement, and ERM will be critical topics. Other important topics are the role of the board, how risk professionals should not only serve the board but also leverage the board, and strategic decision-making.

[20:13] Before the pandemic, teaching virtually was not James’s favorite method. He enjoys interacting with participants. Since the pandemic, we’ve all learned how to learn and to teach in a virtual environment. James says we can make it dynamic and interactive, with a lot of sharing.

[22:53] James thinks they will get into individualized problem-solving. Participants can highlight challenges or opportunities they’re facing. Collectively, the group will help with individualized problem-solving.

[21:12] James will bring in guest speakers. He has a strong network of excellent board directors and experts with backgrounds in AI, cybersecurity, and ERM. These include former or current CROs with stories to share. He believes all that will make the program relevant and dynamic.

[21:45] Plug Time! Let me tell you about the Spencer Educational Foundation. Spencer’s goal to help build a talent pipeline of risk management and insurance professionals is achieved, in part, by its collaboration with risk management and insurance educators across the U.S. and Canada.

[22:05] Since 2010, Spencer has awarded over $3.3 million in General Grants to support over 130 student-centered experiential learning initiatives at universities and RMI non-profits. Spencer’s 2026 application process is now open through July 30th, 2025.

[22:27] General Grant awardees are typically notified at the end of October. Learn more about Spencer’s General Grants through the Programs tab of SpencerEd.org. Be sure to check out Spencer’s Monthly Virtual Campus.

[22:41] On Thursday, June 12th, we will have Reinsurance 101, hosted by Lee Vuu, Founder and President of the MRIA. A link is in this episode’s show notes. Register today!

[22:53] Let’s Conclude Our Interview with James Lam!

[23:22] James says the future is bright. AI and risk analytics are going to change our careers and our lives. In the next five years, we’re going to see some interesting dynamics with AI and we’re going to have some unintended consequences. There will be risks and opportunities.

[23:54] For risk professionals, being able to help our organizations and address the risks, whether it’s privacy, model risks such as hallucination, or data governance, all those are going to be in our wheelhouse, and we could add a lot of value.

[24:11] James thinks AI could create opportunities to enhance enterprise risk management by tapping into structured and unstructured data and help us minimize unexpected earnings variance, optimize capital structure, and support corporate and business-level decisions.

[24:47] A basic question that any AI model asks is, “What would an expert do?” What would an expert driver do in terms of an autonomous car? What would an expert doctor do in this specific situation? In risk management, the senior risk professionals and CROs are the experts.

[25:12] James says the CROs have an opportunity to design the training data that would train these AI agents. They would have an impact on training these AI agents directly in terms of being part of the feedback loop.

[25:32] James is very excited about where ERM is going to be in the next three to five years. AI will become a very important tool. He doesn’t think it will replace risk practitioners.

[25:49] The expertise, judgment, governance, and perspective that risk practitioners bring to the table will be valuable. AI will be a huge enabler.

[26:11] Looking forward 10 years, James asks, using AI, how do we help with scenario planning and scenario analysis? Regarding many of the emerging and disruptive risks that we face today, we don’t have a lot of data or models, so scenario analysis is going to be a critical tool.

[26:48] The ultimate level of enterprise risk management would be to create a digital twin of our organization’s overall risk profile, including our strategic, financial, operational, compliance, and reputational risks, and run scenarios to stress-test that system with AI. That’s not far off.

[27:25] James, it has been such a pleasure to reconnect with you. I have a great feeling about the RIMS CRO Certificate Program in Advanced Enterprise Risk Management. Remember, everyone, you have until July 9th, 2025, to register. Virtual seats are filling up! Check out the link!

[27:43] I have a good feeling that we’re going to be hearing more and seeing more from James in 2025 and beyond, here at RIMS. James, we value you very much. That’s why you’re here!

[28:11] Special thanks again to James Lam. Register now for the RIMS CRO Certificate Program in Advanced Enterprise Risk Management. It is a bi-weekly course that starts on July 16th. Virtual seats are filling up fast, so register by July 7th. The link is in this episode’s show notes.

[28:32] Plug Time! You can sponsor a RIMScast episode for this, our weekly show, or a dedicated episode. Links to sponsored episodes are in the show notes.

[29:00] RIMScast has a global audience of risk and insurance professionals, legal professionals, students, business leaders, C-Suite executives, and more. Let’s collaborate and help you reach them! Contact pd@rims.org for more information.

[29:18] Become a RIMS member and get access to the tools, thought leadership, and network you need to succeed. Visit RIMS.org/membership or email membershipdept@RIMS.org for more information.

[29:35] Risk Knowledge is the RIMS searchable content library that provides relevant information for today’s risk professionals. Materials include RIMS executive reports, survey findings, contributed articles, industry research, benchmarking data, and more.

[29:52] For the best reporting on the profession of risk management, read Risk Management Magazine at RMMagazine.com. It is written and published by the best minds in risk management.

[30:06] Justin Smulison is the Business Content Manager at RIMS. You can email Justin at Content@RIMS.org.

[30:14] Thank you all for your continued support and engagement on social media channels! We appreciate all your kind words. Listen every week! Stay safe!

Links:

RIMS-CRO Certificate in Advanced Enterprise Risk Management — Featuring Instructor James Lam! Register by July 7. | Bi-weekly course begins July 16.

RIMS Texas Regional 2025 — August 3‒5 | Registration now open.

RIMS Canada 2025 — Sept. 14‒17 | Registration now open!

RIMS-Certified Risk Management Professional (RIMS-CRMP)

RISK PAC | RIMS Advocacy

RIMS Risk Management magazine

RIMS Now

The Strategic and Enterprise Risk Center

Spencer Education Foundation — General Grants 2026 — Application Deadline July 30, 2025

Spencer Virtual Campus — Next Course on June 12

RIMS ERM Conference 2025 — Nov 17‒18 in Seattle! [Save the Date!]